1 00:00:00,000 --> 00:00:02,009 ATR2500x-USB Microphone & Logitech BRIO: Today on the backup wrap up, we're 2 00:00:02,009 --> 00:00:04,799 starting a new series on ransomware. 3 00:00:05,219 --> 00:00:09,570 Today's episode starts at the beginning by defining the scourge. 4 00:00:09,780 --> 00:00:10,530 What is it? 5 00:00:10,560 --> 00:00:11,850 What isn't it? 6 00:00:12,329 --> 00:00:17,189 Uh, and why it's become such a massive threat to businesses and individuals. 7 00:00:17,700 --> 00:00:20,369 We'll talk about the evolution of ransomware attacks from 8 00:00:20,369 --> 00:00:24,060 simple data encryption to sophisticated extortion schemes. 9 00:00:24,570 --> 00:00:28,979 And discuss the critical importance of prevention and recovery strategies. 10 00:00:28,979 --> 00:00:32,820 In the coming weeks, you'll see many more episodes on this topic. 11 00:00:32,970 --> 00:00:37,650 As we focus, especially on how to prepare yourself, to be able to respond 12 00:00:37,680 --> 00:00:40,290 and recover from a ransomware attack. 13 00:00:40,860 --> 00:00:43,350 By the way, if you have no idea who I am. 14 00:00:43,350 --> 00:00:43,839 I'm W. 15 00:00:43,860 --> 00:00:44,699 Curtis Preston. 16 00:00:44,730 --> 00:00:45,690 AKA Mr. 17 00:00:45,690 --> 00:00:46,199 Backup. 18 00:00:46,620 --> 00:00:50,010 And I've been passionate about backup and recovery for over 30 years. 19 00:00:50,279 --> 00:00:55,139 Ever since I had to tell my boss that there were no backups of Paris. 20 00:00:55,589 --> 00:00:57,059 I don't want that to happen to you. 21 00:00:57,300 --> 00:00:58,830 And that's why I do this. 22 00:00:59,279 --> 00:01:04,199 On this podcast, we turn unappreciated backup admins into cyber recovery heroes. 23 00:01:04,560 --> 00:01:06,630 This is the backup wrap-up. 24 00:01:20,621 --> 00:01:21,961 W. Curtis Preston: Welcome to the backup wrap up. 25 00:01:22,771 --> 00:01:25,411 I'm your host, w Curtis Preston, AKA, Mr. 26 00:01:25,416 --> 00:01:30,061 Backup, and I have with me the person who's helping me to celebrate 27 00:01:30,271 --> 00:01:33,391 my financial freedom from the IRS. 28 00:01:33,871 --> 00:01:34,531 How's it going? 29 00:01:34,536 --> 00:01:35,011 Persona. 30 00:01:35,716 --> 00:01:37,906 Prasanna Malaiyandi: I am doing well, Curtis. 31 00:01:37,906 --> 00:01:39,766 Yeah, congratulations. 32 00:01:39,766 --> 00:01:46,906 How does it feel to get, what would you call it, uh, the 10 33 00:01:46,906 --> 00:01:48,826 ton elephant off your back? 34 00:01:48,826 --> 00:01:49,576 Is that the 35 00:01:49,711 --> 00:01:50,161 W. Curtis Preston: Yeah. 36 00:01:50,166 --> 00:01:50,491 Yeah. 37 00:01:50,941 --> 00:01:55,981 So for those that don't know, like through various things that weren't malfeasance 38 00:01:55,981 --> 00:01:58,321 on my part I have owed the IRS money. 39 00:01:59,311 --> 00:02:02,711 For the better part of 10 years, two different totally unrelated 40 00:02:02,711 --> 00:02:07,361 events I ended up owing them money and I've been paying them, uh, slowly 41 00:02:07,361 --> 00:02:09,891 and surely for somewhere in the neighborhood of the last 10 years. 42 00:02:10,281 --> 00:02:13,221 And the literally May 1st I. 43 00:02:14,211 --> 00:02:15,381 Made the last payment. 44 00:02:15,411 --> 00:02:23,061 And so for the first time in my fifties, I don't, I don't owe the IR Rs any money. 45 00:02:23,541 --> 00:02:24,321 Um, 46 00:02:24,456 --> 00:02:26,556 Prasanna Malaiyandi: be in your fifties than your eighties, 47 00:02:27,171 --> 00:02:28,041 W. Curtis Preston: yeah, that is true. 48 00:02:28,131 --> 00:02:28,701 That is true. 49 00:02:28,701 --> 00:02:29,301 That is true. 50 00:02:29,841 --> 00:02:32,036 I don't recommend owing the IRS money. 51 00:02:32,036 --> 00:02:33,356 They get theirs for sure. 52 00:02:33,461 --> 00:02:33,761 Prasanna Malaiyandi: Yeah. 53 00:02:34,781 --> 00:02:39,011 W. Curtis Preston: Anyway, um, so I wanted for, we've, we've finished 54 00:02:39,011 --> 00:02:45,731 our series on cloud disasters and we had the one episode on. 55 00:02:46,151 --> 00:02:48,161 The A cloud non-disaster. 56 00:02:48,941 --> 00:02:51,161 It was a cloud disaster that had a good, happy ending. 57 00:02:52,091 --> 00:02:57,431 Um, and I wanted us to get back to something else that has been very 58 00:02:57,436 --> 00:03:01,931 popular with our listeners, which is this, the concept of ransomware. 59 00:03:02,861 --> 00:03:04,661 If you are, um. 60 00:03:05,531 --> 00:03:07,301 You know, a new listener to the podcast. 61 00:03:07,306 --> 00:03:12,371 We have covered ransomware in various ways over the years, and you're going to, 62 00:03:12,671 --> 00:03:15,731 uh, this episode will actually follow up. 63 00:03:15,731 --> 00:03:21,761 I'm going to be, if you're listening to this now, the previous few episodes will 64 00:03:21,761 --> 00:03:26,441 actually be reruns, if you want to call them, of, of, of really good episodes 65 00:03:26,441 --> 00:03:28,361 where we had guests on that really know. 66 00:03:29,036 --> 00:03:33,656 This, uh, issue of, of, of ransomware and recovering from ransomware. 67 00:03:34,166 --> 00:03:37,676 And so I wanted to, um, 68 00:03:38,216 --> 00:03:38,611 Prasanna Malaiyandi: Do you 69 00:03:38,636 --> 00:03:39,446 W. Curtis Preston: we're gonna follow up. 70 00:03:40,076 --> 00:03:40,646 What's that? 71 00:03:41,071 --> 00:03:42,811 Prasanna Malaiyandi: are you gonna put Tony's episode out? 72 00:03:43,871 --> 00:03:45,431 W. Curtis Preston: Uh, oh, you know what? 73 00:03:45,491 --> 00:03:45,821 Yeah. 74 00:03:46,091 --> 00:03:46,691 Uh, yeah. 75 00:03:46,691 --> 00:03:48,401 Now that I realize who you're talking about, yes. 76 00:03:48,401 --> 00:03:49,841 I will definitely put Tony. 77 00:03:49,841 --> 00:03:54,371 So, uh, you know, that's probably was the most popular episode that 78 00:03:54,371 --> 00:03:59,291 we had of that timeframe, which was, uh, our friend Tony over at, uh, 79 00:03:59,351 --> 00:04:01,331 SPECT Logic and them talking about. 80 00:04:01,946 --> 00:04:04,916 How they actually recovered from a ransomware attack. 81 00:04:05,336 --> 00:04:08,816 And, um, and we'll, we'll have some stuff coming up where we're 82 00:04:08,816 --> 00:04:12,896 gonna be talking about ransomware and different things about how to 83 00:04:12,901 --> 00:04:18,056 protect from it and how to, uh, more importantly, how to, I don't know. 84 00:04:18,056 --> 00:04:19,226 More importantly, it's just. 85 00:04:20,036 --> 00:04:22,136 So many people talk about how to protect from it. 86 00:04:22,196 --> 00:04:26,486 They don't talk enough about how to respond to it and how to recover from it. 87 00:04:26,486 --> 00:04:30,086 And that's where, uh, you know, our specialty lies. 88 00:04:31,256 --> 00:04:32,696 But I Go ahead. 89 00:04:33,626 --> 00:04:35,936 Prasanna Malaiyandi: You know what I just read in the paper, or not 90 00:04:35,936 --> 00:04:37,946 the paper, what I read online today. 91 00:04:39,326 --> 00:04:46,376 So insurance companies are now trying to not have companies pay the ransomware 92 00:04:46,376 --> 00:04:49,466 and just sort of keep this self. 93 00:04:50,006 --> 00:04:52,856 Propagating, uh, issue. 94 00:04:52,916 --> 00:04:53,696 Keep going. 95 00:04:54,176 --> 00:04:58,881 And so they're actually working to not, or to tell their 96 00:04:59,311 --> 00:05:01,041 clients, don't pay the ransom, 97 00:05:02,036 --> 00:05:04,406 W. Curtis Preston: Yeah, which is something we've always advised, right? 98 00:05:04,456 --> 00:05:08,926 We can't make that decision on behalf of those, uh, people. 99 00:05:09,196 --> 00:05:13,666 But obviously it's not a good thing to pay the ransom, right? 100 00:05:14,326 --> 00:05:17,206 In some places it may be illegal to pay the ransom. 101 00:05:17,486 --> 00:05:20,216 In other places and well, and in all places. 102 00:05:20,216 --> 00:05:21,866 I think it emboldens the behavior. 103 00:05:22,196 --> 00:05:22,616 Right. 104 00:05:23,006 --> 00:05:23,636 And you're 105 00:05:23,776 --> 00:05:26,026 Prasanna Malaiyandi: I liken it to my dog where it's like, if you want 106 00:05:26,026 --> 00:05:29,386 him to do something, you give him a treat and then he keeps doing it 107 00:05:29,386 --> 00:05:31,876 because he keeps expecting the treat and he knows he'll get a treat. 108 00:05:32,276 --> 00:05:34,646 W. Curtis Preston: Exactly, uh, yeah, there's a lot of 109 00:05:34,646 --> 00:05:35,846 reasons not to pay the ransom. 110 00:05:36,026 --> 00:05:38,851 So let's, let's just start with, I. 111 00:05:39,061 --> 00:05:44,851 Just talking about what ransomware is and just as importantly what ransomware isn't. 112 00:05:45,601 --> 00:05:50,971 So ransomware, um, and, and I'm gonna start with saying 113 00:05:50,971 --> 00:05:53,431 that it's, it's a bad term. 114 00:05:54,271 --> 00:05:54,901 Right. 115 00:05:54,961 --> 00:06:00,061 The, the term ransomware suggests that it's software. 116 00:06:00,361 --> 00:06:05,461 It, it suggests that it is a piece of software that you accidentally 117 00:06:05,461 --> 00:06:07,471 get and boom, you have ransomware. 118 00:06:08,341 --> 00:06:13,561 And that's actually what I thought in my early days of, of working with ransomware. 119 00:06:14,041 --> 00:06:16,531 Prasanna Malaiyandi: If you click the wrong link And then all of a sudden it 120 00:06:16,531 --> 00:06:16,891 encrypts 121 00:06:16,891 --> 00:06:17,191 everything. 122 00:06:17,956 --> 00:06:18,246 yeah, 123 00:06:19,351 --> 00:06:23,101 W. Curtis Preston: And, and that isn't really what it is, or at least not from 124 00:06:23,101 --> 00:06:25,441 what I can tell, uh, most of the time. 125 00:06:25,861 --> 00:06:30,241 But let's just define this concept of ransomware, and it comes from the 126 00:06:30,241 --> 00:06:36,691 term ransom, which, where outside of the world of, of it, where, where 127 00:06:36,691 --> 00:06:38,281 would we see the word ransom used? 128 00:06:38,926 --> 00:06:40,576 Prasanna Malaiyandi: Hostage negotiations, 129 00:06:40,636 --> 00:06:42,166 W. Curtis Preston: Exactly right. 130 00:06:43,061 --> 00:06:43,731 Prasanna Malaiyandi: kidnapping. 131 00:06:43,996 --> 00:06:44,236 W. Curtis Preston: kid. 132 00:06:44,296 --> 00:06:46,096 Yeah, I've taken your kid. 133 00:06:46,096 --> 00:06:48,856 And you can have them back for $1 billion. 134 00:06:48,856 --> 00:06:53,576 the most famous kidnapping of all time that I know of was 135 00:06:53,576 --> 00:06:55,286 the Getty kidnapping, right. 136 00:06:56,156 --> 00:06:59,786 So I believe it was, uh, John Paul Getty at the time that he 137 00:06:59,786 --> 00:07:01,196 was the richest man in the world. 138 00:07:01,196 --> 00:07:07,256 They kidnapped his, um, like grandson and, uh, they demanded probably a 139 00:07:07,256 --> 00:07:08,876 million dollars or something like that. 140 00:07:09,771 --> 00:07:17,421 He told him to go pound sand, and then they sent him, uh, his grandchild's ear 141 00:07:17,991 --> 00:07:22,041 and uh, and he said, fine, you know, I'll, I'll, I'll pay the ransom he got, and 142 00:07:22,046 --> 00:07:24,831 he got the, he got his grandchild back. 143 00:07:25,041 --> 00:07:27,831 Interestingly enough, I sat next to. 144 00:07:27,946 --> 00:07:28,991 Prasanna Malaiyandi: I was gonna say, 145 00:07:29,051 --> 00:07:33,491 W. Curtis Preston: Yeah, I sat next to the grandson of that grandson on a plane once. 146 00:07:33,491 --> 00:07:37,211 His name's Bazar Getty, also, uh, an actor. 147 00:07:37,721 --> 00:07:42,341 Um, and, uh, I just randomly asked him if he was related to the Getty 148 00:07:42,341 --> 00:07:45,071 family, and he's like, well, you know, the, you know, the guy with 149 00:07:45,076 --> 00:07:46,276 the ear that's my grandfather. 150 00:07:46,811 --> 00:07:49,721 It's like, wow, that is definitely a connection. 151 00:07:50,291 --> 00:07:53,201 Um, yeah, so that's what a ransom is, right? 152 00:07:53,201 --> 00:07:56,771 Is is give me, you know, I've got something of yours. 153 00:07:57,611 --> 00:08:00,731 And you can have it back if you give me the ransom. 154 00:08:01,481 --> 00:08:03,701 And you, you've watched tv. 155 00:08:03,821 --> 00:08:04,481 You've watched 156 00:08:04,481 --> 00:08:04,961 movies, 157 00:08:04,966 --> 00:08:05,396 Prasanna Malaiyandi: watch tv. 158 00:08:06,251 --> 00:08:08,981 W. Curtis Preston: well you have watched movies. 159 00:08:09,731 --> 00:08:11,651 You, you definitely watched YouTube more. 160 00:08:12,221 --> 00:08:18,311 What is the general thinking regarding paying the ransom in such movies? 161 00:08:19,221 --> 00:08:22,401 Prasanna Malaiyandi: The SBI comes in and everyone else, and they're like, don't pay 162 00:08:22,401 --> 00:08:24,021 the ransom 'cause you're not gonna see it. 163 00:08:24,021 --> 00:08:26,751 And it's just gonna, they're just gonna go and do something else again. 164 00:08:27,321 --> 00:08:28,071 W. Curtis Preston: Exactly. 165 00:08:28,131 --> 00:08:28,731 Exactly. 166 00:08:28,731 --> 00:08:32,241 And, and they often do things like demand proof of life. 167 00:08:32,331 --> 00:08:32,751 Right. 168 00:08:32,811 --> 00:08:33,321 Um, 169 00:08:33,351 --> 00:08:35,421 Prasanna Malaiyandi: Hold up the newspaper with today's date. 170 00:08:35,511 --> 00:08:36,471 W. Curtis Preston: Exactly right. 171 00:08:36,471 --> 00:08:37,701 I want to talk to my kid. 172 00:08:37,701 --> 00:08:37,851 Right. 173 00:08:37,851 --> 00:08:38,721 I want to verify. 174 00:08:38,721 --> 00:08:39,081 Right. 175 00:08:39,171 --> 00:08:45,591 And all of this has, uh, they, they have parallels in the, the 176 00:08:45,591 --> 00:08:47,511 world of the ransomware, right? 177 00:08:47,796 --> 00:08:48,086 Prasanna Malaiyandi: Yeah. 178 00:08:48,621 --> 00:08:52,761 W. Curtis Preston: So really, it, this is where the term comes from, is that 179 00:08:52,761 --> 00:08:56,151 we're holding your data for ransom. 180 00:08:56,451 --> 00:09:02,061 And the, the classic way that that manifested itself was what? 181 00:09:02,751 --> 00:09:05,781 Prasanna Malaiyandi: They basically would encrypt your data and say, Hey, if you 182 00:09:05,781 --> 00:09:10,101 want your data back, then pay us the money and we will give you the encryption key 183 00:09:10,101 --> 00:09:13,551 so then you can go unencrypt your data and everything will be back to normal. 184 00:09:14,226 --> 00:09:15,156 W. Curtis Preston: Yeah, it's interesting. 185 00:09:15,156 --> 00:09:19,056 They, they don't steal it, like in the, in the old, in, in the way of the, you 186 00:09:19,061 --> 00:09:24,241 know, the, um, uh, of stealing your, your child to, to demand a ransom. 187 00:09:24,511 --> 00:09:24,801 They. 188 00:09:25,461 --> 00:09:28,911 Steal it right away from you, like right in front of you. 189 00:09:29,091 --> 00:09:31,881 It's like, here's your data, but you can't use it. 190 00:09:31,881 --> 00:09:32,361 You can't 191 00:09:32,361 --> 00:09:32,781 have it. 192 00:09:33,351 --> 00:09:35,871 Prasanna Malaiyandi: but I think it's also one of those things where it's probably 193 00:09:35,961 --> 00:09:38,421 faster and easier for them, right? 194 00:09:38,471 --> 00:09:40,811 anD maybe it's also less detectable, right? 195 00:09:40,811 --> 00:09:44,261 Because all of a sudden if you're like, Hey, why is my, why am I 196 00:09:44,261 --> 00:09:46,541 uploading like 10 terabytes today? 197 00:09:47,666 --> 00:09:48,446 W. Curtis Preston: Exactly. 198 00:09:48,506 --> 00:09:49,136 Yeah. 199 00:09:49,256 --> 00:09:53,006 It, it's super easy and super fast to, to encrypt the data just 200 00:09:53,006 --> 00:09:55,226 enough that it's not useful to you. 201 00:09:55,886 --> 00:09:59,636 And so they're saying, we'll give you the keys, um, you know, 202 00:09:59,636 --> 00:10:00,836 and you can have your data back. 203 00:10:00,836 --> 00:10:03,416 That is a traditional ransomware attack. 204 00:10:03,746 --> 00:10:04,316 What was that? 205 00:10:04,751 --> 00:10:05,771 Prasanna Malaiyandi: Hopefully we will 206 00:10:05,771 --> 00:10:09,011 give you the keys and you can recover your data. 207 00:10:09,356 --> 00:10:10,376 W. Curtis Preston: Right, right. 208 00:10:10,376 --> 00:10:20,186 And the idea was that, that, that paying the ransom, you know, historically paying 209 00:10:20,186 --> 00:10:24,477 the ransom was only a good idea if you had no backup of your data or if your backup. 210 00:10:25,421 --> 00:10:30,011 Was such that it was going to take you so long in order to restore. 211 00:10:30,281 --> 00:10:34,391 I, when I think back to one of the most famous ransomware attacks in 212 00:10:34,391 --> 00:10:40,091 the last few years was the Colonial pipeline attack, and that one, as I 213 00:10:40,091 --> 00:10:43,871 understand it, was that they had a. 214 00:10:45,656 --> 00:10:47,126 A backup, right? 215 00:10:47,276 --> 00:10:51,686 But they didn't think they could get the backup recovered fast enough. 216 00:10:51,686 --> 00:10:53,666 And so they decided to pay the ransom. 217 00:10:54,506 --> 00:11:00,296 And, um, and, and so they did both, they did recovery and they paid the ransom, 218 00:11:00,956 --> 00:11:04,736 and, which just seems fundamentally wrong, but historically, that was the 219 00:11:04,736 --> 00:11:09,446 only reason that you would pay the ransom is if you had no backup or a backup. 220 00:11:09,446 --> 00:11:12,176 That was not good enough because. 221 00:11:12,746 --> 00:11:16,691 Unencrypting the data or deen encrypting the data was, the idea 222 00:11:16,691 --> 00:11:20,291 was that deen encrypting the data was faster than restoring it, right? 223 00:11:20,651 --> 00:11:21,521 Prasanna Malaiyandi: Yep, yep. 224 00:11:21,611 --> 00:11:26,976 And that was worthwhile until sort of the. 225 00:11:28,076 --> 00:11:34,496 Ransomware actors, they had poor code quality, right? 226 00:11:34,496 --> 00:11:38,516 And so you're putting faith that you are going to pay the ransom 227 00:11:38,516 --> 00:11:42,326 and you're going to, going back to our classic example, right? 228 00:11:42,326 --> 00:11:43,736 You're gonna get back your kid, 229 00:11:44,261 --> 00:11:44,711 W. Curtis Preston: Right. 230 00:11:44,891 --> 00:11:45,251 Yeah. 231 00:11:45,416 --> 00:11:47,846 Prasanna Malaiyandi: Except sometimes these ransomware actors, 232 00:11:47,846 --> 00:11:49,706 they would write sort of bad code. 233 00:11:49,736 --> 00:11:53,006 And when they gave you back the key, like how they actually did the encryption 234 00:11:53,801 --> 00:11:54,131 W. Curtis Preston: Right. 235 00:11:54,296 --> 00:11:55,226 Prasanna Malaiyandi: very sound. 236 00:11:55,226 --> 00:11:56,756 And so yeah, it would. 237 00:11:57,236 --> 00:11:59,876 Decrypt maybe some of the data, but it wasn't still usable. 238 00:11:59,876 --> 00:12:04,316 So that's like paying the ransom and they give back your kid's finger. 239 00:12:04,976 --> 00:12:05,276 Right. 240 00:12:05,336 --> 00:12:05,846 Or 241 00:12:06,176 --> 00:12:06,466 W. Curtis Preston: Yeah, 242 00:12:07,196 --> 00:12:07,556 Prasanna Malaiyandi: right. 243 00:12:07,561 --> 00:12:08,036 Or 244 00:12:08,486 --> 00:12:08,786 Right. 245 00:12:08,786 --> 00:12:11,756 Or Or they give like a doll of your kid back. 246 00:12:11,756 --> 00:12:11,966 Right. 247 00:12:11,971 --> 00:12:12,776 Or whatever it is. 248 00:12:12,776 --> 00:12:12,956 Right. 249 00:12:12,961 --> 00:12:15,896 But it's not what you originally had transacted for. 250 00:12:15,926 --> 00:12:18,836 W. Curtis Preston: Here's some videos of your, while we, while we had kidnapped. 251 00:12:19,476 --> 00:12:23,106 You have to think about these organizations as very 252 00:12:23,106 --> 00:12:24,876 sophisticated businesses. 253 00:12:25,116 --> 00:12:26,646 This is not a script kitty. 254 00:12:26,646 --> 00:12:29,526 This is not a random piece of software that you download off the internet. 255 00:12:29,856 --> 00:12:35,556 This is an organization that is trying to make money for other reasons, right? 256 00:12:35,556 --> 00:12:36,726 They're, they want to do things. 257 00:12:36,726 --> 00:12:40,296 Sometimes they're state actors, sometimes they're, they're just criminals that are 258 00:12:40,296 --> 00:12:43,386 just trying to make a lot of money and. 259 00:12:43,926 --> 00:12:48,486 You need to think about what are they going to focus on 260 00:12:48,486 --> 00:12:49,776 in terms of software quality? 261 00:12:49,776 --> 00:12:52,446 The thing they're gonna focus on is making sure that the data gets 262 00:12:52,446 --> 00:12:56,706 encrypted and making sure that you can't decrypt it without their help. 263 00:12:57,066 --> 00:13:00,636 They're not necessarily that focused on that second half, 264 00:13:00,636 --> 00:13:02,496 which is the the decryption part. 265 00:13:03,036 --> 00:13:06,876 You could make some argument that maybe they want it to work because 266 00:13:06,876 --> 00:13:08,586 they want to have a reputation as. 267 00:13:10,066 --> 00:13:13,246 An organization that does get the data back if you actually pay 268 00:13:13,246 --> 00:13:16,876 the ransom, but the, you know, 269 00:13:17,451 --> 00:13:21,351 Prasanna Malaiyandi: yeah, or the other thing is it may not be very fast, right? 270 00:13:21,831 --> 00:13:22,581 So 271 00:13:22,971 --> 00:13:25,911 you might get all your data back, but it might take you a month 272 00:13:26,356 --> 00:13:26,956 W. Curtis Preston: Exactly. 273 00:13:26,956 --> 00:13:27,586 Exactly. 274 00:13:28,456 --> 00:13:30,556 Um, so go ahead. 275 00:13:31,461 --> 00:13:36,321 Prasanna Malaiyandi: I know you talked about, uh, these organizations, right? 276 00:13:36,321 --> 00:13:38,481 By which you mean the ransomware actors. 277 00:13:39,771 --> 00:13:41,751 Who are kind of well organized. 278 00:13:41,756 --> 00:13:46,611 I think the other thing to also mention is it's no longer just a 279 00:13:46,611 --> 00:13:49,551 single organization necessarily, right? 280 00:13:49,581 --> 00:13:53,661 You have ransomware as a service where you have these people who have all these 281 00:13:53,661 --> 00:13:59,451 tools and capabilities and they provided as a service just like you might use AWS 282 00:13:59,451 --> 00:14:01,611 as a service to host your application. 283 00:14:01,851 --> 00:14:04,371 They provide all the infrastructure tooling for all these other 284 00:14:04,371 --> 00:14:06,081 organizations to now start. 285 00:14:06,561 --> 00:14:06,981 Um. 286 00:14:07,521 --> 00:14:11,841 Attacking other companies and also encrypting their data. 287 00:14:12,291 --> 00:14:12,801 W. Curtis Preston: Right. 288 00:14:12,801 --> 00:14:13,251 Yeah. 289 00:14:13,256 --> 00:14:16,071 And, and actually I want to get into that in, in a little bit, 290 00:14:16,281 --> 00:14:19,821 um, what I want to, and that, that everything you said is, is correct. 291 00:14:19,971 --> 00:14:23,721 Um, let's talk a little bit about what ransomware is not 292 00:14:24,231 --> 00:14:25,941 Prasanna Malaiyandi: what is ransomware, not Curtis. 293 00:14:26,136 --> 00:14:30,276 W. Curtis Preston: So it, well, it's not just a piece of software that downloads 294 00:14:30,276 --> 00:14:32,466 and, you know, magic happens, right? 295 00:14:33,066 --> 00:14:37,836 Um, the, the, the process of getting infected with ransomware is actually 296 00:14:37,841 --> 00:14:41,796 a very manual process with many steps. 297 00:14:42,336 --> 00:14:49,056 And, uh, and, and they are steps that are being manually driven by a human 298 00:14:49,056 --> 00:14:50,886 being somewhere else in the world. 299 00:14:51,306 --> 00:14:52,086 And. 300 00:14:52,686 --> 00:14:56,826 The, the idea is that there is that initial access. 301 00:14:57,426 --> 00:15:01,956 There is, uh, that, that, you know, that basically the, the initial breach, which 302 00:15:01,956 --> 00:15:05,496 could be via a number of mechanisms. 303 00:15:05,496 --> 00:15:07,776 It could be, uh, old school phishing. 304 00:15:07,776 --> 00:15:09,636 It could be something that you download. 305 00:15:09,996 --> 00:15:13,236 Uh, it, it quite possibly will be something that you download, that 306 00:15:13,236 --> 00:15:17,376 you get via email, an attachment that you open that you shouldn't have. 307 00:15:17,406 --> 00:15:18,816 What was the, what was the thing you said? 308 00:15:20,721 --> 00:15:23,001 Yeah, it could be a zero day exploit, right? 309 00:15:24,011 --> 00:15:31,181 There are myriad ways that you can basically find yourself with a 310 00:15:31,181 --> 00:15:33,851 portal to, to the bad guys, right? 311 00:15:34,061 --> 00:15:37,661 So that, that's the first thing that has to happen, is someone has to gain 312 00:15:37,961 --> 00:15:44,051 remote access, usually with escalated privileges, but not necessarily so. 313 00:15:44,651 --> 00:15:48,281 They might just have a, you know, they might have simply 314 00:15:49,061 --> 00:15:51,371 leveraged stolen credentials. 315 00:15:51,371 --> 00:15:52,001 That's another thing. 316 00:15:52,031 --> 00:15:54,371 They, they leveraged stolen credentials and then you didn't 317 00:15:54,371 --> 00:15:59,471 have MFA on, you might have had a, a server that's got RDP enabled 318 00:15:59,471 --> 00:16:01,001 and it's, uh, open to the internet. 319 00:16:01,031 --> 00:16:01,811 Oh my Lord. 320 00:16:01,816 --> 00:16:04,211 RDP, the ransomware deployment protocol, 321 00:16:04,811 --> 00:16:08,711 Prasanna Malaiyandi: or you just have insecure systems that are internet facing, 322 00:16:09,041 --> 00:16:09,251 right? 323 00:16:09,251 --> 00:16:14,351 How many people have like VMware, ESXI, and then they automatically have it 324 00:16:14,351 --> 00:16:15,971 available on the internet and boom. 325 00:16:16,481 --> 00:16:17,231 W. Curtis Preston: Exactly. 326 00:16:17,381 --> 00:16:17,591 Yeah. 327 00:16:17,591 --> 00:16:21,401 So there, like I said, there, there are myriad ways that you, 328 00:16:21,401 --> 00:16:24,761 that a bad actor can be given. 329 00:16:25,316 --> 00:16:30,356 Initial access to one or more, uh, systems. 330 00:16:30,361 --> 00:16:30,746 Right. 331 00:16:31,106 --> 00:16:35,276 And there are, and this was, uh, basically you, you referenced this 332 00:16:35,276 --> 00:16:40,141 earlier, is that there are companies, and again, it's the correct. 333 00:16:40,571 --> 00:16:42,371 Thing is to call them companies, right? 334 00:16:42,821 --> 00:16:44,891 There are companies who, this is what they do. 335 00:16:44,891 --> 00:16:46,871 They call them initial access brokers. 336 00:16:47,171 --> 00:16:48,431 This is all they do. 337 00:16:48,461 --> 00:16:52,631 They just get a foothold into an organization and then they say, Hey, 338 00:16:52,631 --> 00:16:54,941 I've got a foothold into a, b, c company. 339 00:16:55,151 --> 00:16:56,441 Who wants that? 340 00:16:56,651 --> 00:16:59,741 And then they bid that on the, you know, on the dark web. 341 00:17:02,436 --> 00:17:06,426 Prasanna Malaiyandi: It just kind of scary when you think about it, right? 342 00:17:06,456 --> 00:17:09,126 Because it is a specialized role, right? 343 00:17:09,126 --> 00:17:12,576 That is all they do day in and day out is they try to figure out, how do 344 00:17:12,576 --> 00:17:16,686 I gain that initial foothold with all these various mechanisms that you talked 345 00:17:16,686 --> 00:17:20,796 about, Curtis, and then take that and now pass it on to the next person, right? 346 00:17:20,796 --> 00:17:23,436 And it's their job to now figure out, okay, now what can I do next? 347 00:17:23,811 --> 00:17:26,511 W. Curtis Preston: Yeah, it's a very specialized world, right? 348 00:17:26,571 --> 00:17:29,061 Um, because there's sort of three phases. 349 00:17:29,061 --> 00:17:34,671 There's that initial access, there's a second phase, which is discovery and uh, 350 00:17:34,671 --> 00:17:39,081 and crawling around trying to do lateral movement, trying to expand the footprint. 351 00:17:39,741 --> 00:17:45,081 And, um, and, and then that third phase, which is the actual, we're going 352 00:17:45,081 --> 00:17:47,121 to go and encrypt everything, right? 353 00:17:47,691 --> 00:17:48,861 The go ahead. 354 00:17:49,361 --> 00:17:50,741 Prasanna Malaiyandi: And that second phase, right? 355 00:17:51,041 --> 00:17:52,511 Just to touch on it, right? 356 00:17:52,721 --> 00:17:55,571 Moving laterally and trying to figure out other things, right? 357 00:17:55,931 --> 00:17:58,691 They're trying to do all of this while staying undetected, right? 358 00:17:58,691 --> 00:18:03,941 Because the last thing you wanna do is give up that access that you paid for from 359 00:18:04,391 --> 00:18:06,581 initial access broker, right? 360 00:18:06,581 --> 00:18:10,481 And so you wanna make sure you stay under the radar of the security team 361 00:18:10,481 --> 00:18:14,022 or whoever else is out there trying to prevent what you're trying to do. 362 00:18:14,621 --> 00:18:19,631 W. Curtis Preston: Which is why one of the ways they do well, I would say the 363 00:18:19,631 --> 00:18:25,961 way that they do that next phase is they use the same tools that you use, right? 364 00:18:25,991 --> 00:18:31,181 They're downloading cybersecurity tools that are designed to defend, 365 00:18:31,181 --> 00:18:32,651 but they use them to attack. 366 00:18:33,131 --> 00:18:34,631 Prasanna Malaiyandi: How about Strike is a common 367 00:18:34,631 --> 00:18:34,901 one 368 00:18:34,951 --> 00:18:35,221 W. Curtis Preston: yeah. 369 00:18:35,251 --> 00:18:38,191 Cobalt Strike is definitely one of the, uh, most common ones. 370 00:18:38,581 --> 00:18:42,331 And, uh, there are a number of other tools that they download that, that don't 371 00:18:42,331 --> 00:18:47,431 initially set off alarms because they're not, it's not like, Hey, hacker tool dot 372 00:18:47,436 --> 00:18:50,731 exe, it's a tool that you would install. 373 00:18:51,471 --> 00:18:55,131 And so they, they install these tools and then they go and they, 374 00:18:55,191 --> 00:18:56,901 they crawl around your organization. 375 00:18:56,991 --> 00:19:02,631 And it can be very difficult to detect that once they have gained that foothold 376 00:19:02,631 --> 00:19:06,771 and once they're using the same tools that you might be using to poke around. 377 00:19:07,551 --> 00:19:10,611 And again, I, I'll go back to that initial access. 378 00:19:10,611 --> 00:19:12,531 This is why MFA is so important. 379 00:19:13,576 --> 00:19:18,196 Uh, they could, there are a number of ways that they could get in, but MFA would be 380 00:19:18,196 --> 00:19:19,756 one of the ways that you would then stop. 381 00:19:19,876 --> 00:19:24,226 By the way, it, it does appear that the most common way that they get 382 00:19:24,226 --> 00:19:25,606 in is actually stolen credentials. 383 00:19:26,401 --> 00:19:26,731 Right. 384 00:19:27,091 --> 00:19:30,361 And um, which is just really sad. 385 00:19:30,901 --> 00:19:34,321 Um, but, but it is what It's Right. 386 00:19:34,681 --> 00:19:35,041 Yeah. 387 00:19:35,101 --> 00:19:35,491 Yeah. 388 00:19:36,151 --> 00:19:38,701 Um, and, and so I, I just, this is the thing. 389 00:19:38,731 --> 00:19:40,831 This is where the, what ransomware is not. 390 00:19:40,831 --> 00:19:44,971 I just want people to understand that ransomware is not just one 391 00:19:44,971 --> 00:19:47,851 piece of software that you happen to accidentally download and then 392 00:19:47,856 --> 00:19:49,231 it affects your entire data center. 393 00:19:49,901 --> 00:19:53,351 That is absolutely what I, what I, what I used to think it was. 394 00:19:53,801 --> 00:19:58,871 Uh, it is a very sophisticated series of actions that are taken in series 395 00:19:58,961 --> 00:20:03,881 different, there may be as many as a dozen pieces of software that are 396 00:20:03,881 --> 00:20:12,671 installed to affect the ultimate goal that the, the bad actor wants, uh, 397 00:20:12,671 --> 00:20:14,681 which of course is demanding the ransom. 398 00:20:15,376 --> 00:20:17,476 Prasanna Malaiyandi: I do wonder though. 399 00:20:17,776 --> 00:20:18,436 Yeah, I do. 400 00:20:18,496 --> 00:20:19,216 I agree with that. 401 00:20:19,216 --> 00:20:23,716 Curtis, I also wonder though, if we should really think about sort of two segments 402 00:20:24,046 --> 00:20:26,566 to, uh, victim segments, if you will. 403 00:20:26,956 --> 00:20:30,136 One is the enterprise, which I think a hundred percent everything you said makes 404 00:20:30,136 --> 00:20:30,646 sense. 405 00:20:31,006 --> 00:20:34,096 I think though, when you think about sort of consumer side. 406 00:20:34,636 --> 00:20:40,366 I think it might be slightly different in term because you aren't going to have 407 00:20:40,366 --> 00:20:43,156 all of this individual access, right? 408 00:20:43,156 --> 00:20:48,166 People spending time on grandma trying to gain access to her laptop, right? 409 00:20:48,526 --> 00:20:53,296 I think in those cases it's probably more find common vulnerabilities and 410 00:20:53,296 --> 00:20:56,176 whatever is the quickest and easiest way, and you just go as broad as you 411 00:20:56,176 --> 00:21:01,996 can because their data may not be as sensitive and as valuable necessarily. 412 00:21:02,776 --> 00:21:04,096 Or the willingness to pay. 413 00:21:04,156 --> 00:21:05,176 Or the ability to pay. 414 00:21:06,001 --> 00:21:07,561 W. Curtis Preston: I do think that 415 00:21:09,691 --> 00:21:11,311 consumer based. 416 00:21:12,256 --> 00:21:17,026 Attacks probably are much closer to that initial, I download one piece of software 417 00:21:17,026 --> 00:21:18,826 and it grabs all my data and boom, right? 418 00:21:19,006 --> 00:21:21,556 And then tries to reach out to a command and control server. 419 00:21:22,306 --> 00:21:27,046 Uh, and then it's probably closer to that initial definition than we talked 420 00:21:27,051 --> 00:21:30,676 about where it's just one single piece of software because there, there really 421 00:21:30,676 --> 00:21:32,986 isn't anything else, uh, to get out there. 422 00:21:33,676 --> 00:21:36,466 But that's not necessarily our target market. 423 00:21:36,466 --> 00:21:37,876 So I wasn't really focusing on that. 424 00:21:38,206 --> 00:21:40,426 But you know, from a company perspective. 425 00:21:40,921 --> 00:21:44,671 Uh, you know, or any, any organization perspective, it's going 426 00:21:44,671 --> 00:21:46,801 to be a very complicated process. 427 00:21:47,131 --> 00:21:51,121 Uh, and that could go on for months 428 00:21:51,361 --> 00:21:52,171 Prasanna Malaiyandi: I was actually gonna 429 00:21:52,261 --> 00:21:55,171 W. Curtis Preston: before you actually get a, you know, a big, a big payload. 430 00:21:55,801 --> 00:21:56,161 Prasanna Malaiyandi: Yeah. 431 00:21:56,701 --> 00:21:56,911 Yeah. 432 00:21:56,911 --> 00:22:01,561 Just uh, I think if I go back and think about, and it's not ransomware, but just 433 00:22:01,561 --> 00:22:05,851 talking about this attack vector, because it is common in other places as well. 434 00:22:06,031 --> 00:22:08,341 If I think about like the SolarWinds attack, right? 435 00:22:08,341 --> 00:22:10,921 They were in their systems for months, 436 00:22:11,371 --> 00:22:11,851 right? 437 00:22:13,456 --> 00:22:15,376 W. Curtis Preston: they were part of the, they were actually part of the 438 00:22:15,381 --> 00:22:17,476 supply chain, as I recall, right? 439 00:22:17,536 --> 00:22:17,836 Yeah. 440 00:22:18,226 --> 00:22:18,556 Yeah. 441 00:22:19,186 --> 00:22:23,956 They're very, depending on the size of the fish, right? 442 00:22:24,256 --> 00:22:25,726 They're very, very there. 443 00:22:25,731 --> 00:22:27,346 There is a risk reward. 444 00:22:28,591 --> 00:22:30,451 Um, you know, a trade off, right? 445 00:22:30,451 --> 00:22:36,991 The longer they can stay in undetected, the more exploration that they can do, 446 00:22:37,291 --> 00:22:42,061 the bigger the payoff, but the longer they stay in undetected, the greater 447 00:22:42,061 --> 00:22:45,841 the risk that they will eventually be detected before they can do the payoff. 448 00:22:46,201 --> 00:22:49,471 So there's a, you know, a big risk reward there. 449 00:22:50,041 --> 00:22:50,371 Prasanna Malaiyandi: Yeah. 450 00:22:50,731 --> 00:22:54,601 W. Curtis Preston: Um, so the other and really important 451 00:22:54,601 --> 00:22:56,911 thing, and this is why, um. 452 00:22:57,256 --> 00:23:07,006 This is why some have changing the name of, uh, ransomware and that is that no 453 00:23:07,006 --> 00:23:13,306 longer, um, is simply encrypting the data and then saying you can have it back if 454 00:23:13,306 --> 00:23:16,066 you, uh, give us a ransomware no longer. 455 00:23:16,066 --> 00:23:21,706 Is that the normal mo of the, the ransomware attackers? 456 00:23:21,706 --> 00:23:22,126 What 457 00:23:22,126 --> 00:23:23,211 is the normal mo. 458 00:23:24,106 --> 00:23:28,816 Have evolved, or I would say devolved, but yeah, they have, they have evolved. 459 00:23:28,836 --> 00:23:29,076 Prasanna Malaiyandi: Right. 460 00:23:29,821 --> 00:23:30,151 Yeah. 461 00:23:30,151 --> 00:23:36,631 So now they realize, okay, people have backups, they have other systems, right? 462 00:23:36,661 --> 00:23:41,281 And so I would say before we get to sort of, okay, what is it really now, 463 00:23:41,761 --> 00:23:42,121 right? 464 00:23:42,841 --> 00:23:45,841 I think in between what they had started to do was really 465 00:23:45,841 --> 00:23:47,251 attack those systems, right? 466 00:23:47,256 --> 00:23:49,111 So it wasn't just encrypt your data, 467 00:23:49,421 --> 00:23:49,771 W. Curtis Preston: Right. 468 00:23:50,011 --> 00:23:52,591 Prasanna Malaiyandi: But even locally it was like, Hey, now let's start 469 00:23:52,591 --> 00:23:55,291 going after the backup systems, right? 470 00:23:55,291 --> 00:23:58,051 Because if you can restore your data, then you don't need us, right? 471 00:23:58,051 --> 00:23:58,831 You don't need the key. 472 00:24:00,061 --> 00:24:00,421 W. Curtis Preston: Yeah, 473 00:24:01,261 --> 00:24:02,821 that, that is a really good point. 474 00:24:02,821 --> 00:24:08,131 That basically part of that sophisticated ex, you know, um, uh, 475 00:24:08,161 --> 00:24:12,811 large attack, they are definitely going to go after the backup system. 476 00:24:12,811 --> 00:24:16,651 They're trying to identify what your backup system, they know the 477 00:24:16,651 --> 00:24:20,281 vulnerabilities of the different backup systems, and they then 478 00:24:20,281 --> 00:24:21,841 go after those vulnerabilities. 479 00:24:21,991 --> 00:24:22,561 And this is. 480 00:24:22,921 --> 00:24:26,821 Why I talk about, and we'll talk later about changes that you should 481 00:24:26,821 --> 00:24:31,021 be making to your backup system in order to protect from this. 482 00:24:31,856 --> 00:24:37,826 This is part of the evolution of the, of these ransomware attackers, is 483 00:24:37,916 --> 00:24:39,446 first all they had to do was encrypt. 484 00:24:39,656 --> 00:24:42,056 And then they found out, uh, you know, and people would pay the ransom. 485 00:24:42,266 --> 00:24:44,756 And then they found that some people had backup and recovery systems 486 00:24:44,996 --> 00:24:48,596 and disaster recovery systems, and they were stopped, pay the ransom. 487 00:24:48,596 --> 00:24:50,006 Well, they want people to pay the ransom. 488 00:24:50,216 --> 00:24:51,896 And so they're like, well, what can we do next? 489 00:24:51,896 --> 00:24:55,226 And so the next thing they decided to do was attack the backup systems. 490 00:24:55,886 --> 00:24:58,196 Prasanna Malaiyandi: I, I don't think that they listen to this podcast 491 00:24:58,196 --> 00:24:59,456 or I've read your books, Curtis. 492 00:25:00,716 --> 00:25:01,376 I'm just saying. 493 00:25:02,021 --> 00:25:02,981 W. Curtis Preston: Yeah, I don't think so. 494 00:25:03,041 --> 00:25:03,761 I don't think so. 495 00:25:04,071 --> 00:25:08,421 They went after specific backup products that had specific vulnerabilities, 496 00:25:08,781 --> 00:25:13,101 especially Windows based backup products, because Windows was the, you know, or 497 00:25:13,161 --> 00:25:15,501 it continues to be the prop predominant. 498 00:25:16,626 --> 00:25:18,486 Os that they're attacking in a ransomware attack. 499 00:25:18,486 --> 00:25:20,586 It's not the only one, but it is a predominant one. 500 00:25:21,846 --> 00:25:24,576 So they went after backup systems that were based on windows. 501 00:25:24,816 --> 00:25:28,476 Also backup systems whose backups were all stored on disk. 502 00:25:28,656 --> 00:25:31,776 'cause those backups are easy to, uh, delete and or encrypt. 503 00:25:31,926 --> 00:25:32,256 Right? 504 00:25:32,976 --> 00:25:34,896 Um, and. 505 00:25:35,436 --> 00:25:38,766 The, and we'll, we'll talk more about things, but the idea is to, 506 00:25:39,126 --> 00:25:43,116 with the backup system, the, the, the quick answer is to make sure 507 00:25:43,116 --> 00:25:46,596 that your backup system isn't susceptible to those types of attacks. 508 00:25:46,626 --> 00:25:48,816 We'll talk about that, uh, in another episode. 509 00:25:49,086 --> 00:25:51,336 Prasanna Malaiyandi: That could be an entire episode in and of itself. 510 00:25:51,366 --> 00:25:52,386 W. Curtis Preston: Yeah, exactly. 511 00:25:52,476 --> 00:25:54,966 Uh, so what, what happened next? 512 00:25:55,386 --> 00:25:55,686 Prasanna Malaiyandi: yeah. 513 00:25:55,956 --> 00:25:58,746 So then, okay, they went after a backup system. 514 00:25:58,746 --> 00:26:00,756 Sometimes they were successful, sometimes they weren't. 515 00:26:01,116 --> 00:26:06,126 But then they realized just like classic ransomware or classic kidnapping and 516 00:26:06,126 --> 00:26:11,226 people paying ransom, they're like, Hey, if we actually take your data right. 517 00:26:11,871 --> 00:26:15,471 Then now you don't have that option to be like, Hey, just 518 00:26:15,471 --> 00:26:16,491 give me the encryption key. 519 00:26:16,491 --> 00:26:21,411 You can actually blackmail people and say, by the way, if you don't want me 520 00:26:21,411 --> 00:26:24,501 to release this information, pay up. 521 00:26:24,891 --> 00:26:29,996 And it might be sensitive information like the Sony hack where they 522 00:26:30,291 --> 00:26:36,051 exfiltrated a bunch of data and it was emails about studio, like what studio 523 00:26:36,051 --> 00:26:39,831 executives were saying and all the rest things you don't want out in public. 524 00:26:40,581 --> 00:26:41,061 W. Curtis Preston: Right. 525 00:26:41,391 --> 00:26:41,841 Yeah. 526 00:26:42,051 --> 00:26:43,731 And, and it could be anything. 527 00:26:43,731 --> 00:26:47,061 I, I think the Sony attack was the first one that I really remember. 528 00:26:47,781 --> 00:26:51,711 Because it was basically impair, it was embarrassing data. 529 00:26:52,581 --> 00:26:59,241 There are, um, others where it's like, listen, we have your 11 herbs and spices 530 00:26:59,241 --> 00:27:00,801 and we're gonna release 'em to the public. 531 00:27:00,861 --> 00:27:03,261 By the way, the 11 herbs and spices, I'm pretty sure have been 532 00:27:03,266 --> 00:27:09,261 released, but not by KFC, but, but by other comp or other entities. 533 00:27:09,951 --> 00:27:12,711 But you know, we have your company's trade secrets. 534 00:27:13,431 --> 00:27:19,041 We may have, um, proof of you doing things that are actually crimes, right? 535 00:27:19,101 --> 00:27:25,311 We, you know, um, you know, there are basically, we might have competitive 536 00:27:25,316 --> 00:27:29,751 information that you don't want given to your closest competitor. 537 00:27:30,261 --> 00:27:33,951 There are a number of things, and also I'd say the, the, the one 538 00:27:33,951 --> 00:27:37,911 category of data that we haven't discussed is we have PII, right? 539 00:27:37,941 --> 00:27:40,911 We have a whole bunch of names and credit card data. 540 00:27:41,256 --> 00:27:43,986 That we're going to release if you don't pay the ransom. 541 00:27:43,986 --> 00:27:49,206 I'd say the best example of that would be the Ashley Madison attack. 542 00:27:50,436 --> 00:27:54,096 I don't remember if that was actually a ransomware attack, but that is an example 543 00:27:54,101 --> 00:27:55,686 of the kind of thing I'm so Ashley mad. 544 00:27:55,686 --> 00:27:59,616 So for those that you don't remember, and it's still around amazingly 545 00:27:59,616 --> 00:28:04,896 enough, Ashley Madison is a website and an organization designed, uh, to 546 00:28:04,896 --> 00:28:06,396 help people cheat on their spouses. 547 00:28:07,326 --> 00:28:12,066 And they released a bunch of identities of people that were there. 548 00:28:12,126 --> 00:28:15,696 There were a number of suicides that followed that, uh, particular incident. 549 00:28:15,816 --> 00:28:19,026 So it could be personal information, it could be medical information. 550 00:28:20,066 --> 00:28:23,496 Prasanna Malaiyandi: Healthcare records of celebrities or even other folks that 551 00:28:23,496 --> 00:28:26,121 could be detrimental if released publicly. 552 00:28:26,586 --> 00:28:27,396 W. Curtis Preston: Right, right. 553 00:28:27,816 --> 00:28:29,466 And, and put it into your company. 554 00:28:29,556 --> 00:28:33,666 Amazingly, Ashley Madison, they released all that stuff and one of the things that 555 00:28:33,666 --> 00:28:37,476 came out was that it turns out that all of the female subscribers were all fake, 556 00:28:40,476 --> 00:28:42,216 and yet the company still runs. 557 00:28:43,476 --> 00:28:47,256 The company is still out there and people are still paying memberships. 558 00:28:47,886 --> 00:28:53,496 But, um, yeah, so that's, that is an important. 559 00:28:53,916 --> 00:28:57,426 Change in how the, the ransomware folks are operating. 560 00:28:57,426 --> 00:29:01,206 Uh, basically, this is why many people are now starting to call it extortion 561 00:29:01,206 --> 00:29:05,796 wear rather than just ransomware, because they're saying that we, we 562 00:29:05,796 --> 00:29:09,066 literally have stolen your data and we are going to release it to the 563 00:29:09,071 --> 00:29:11,556 public if you don't give us the ransom. 564 00:29:12,036 --> 00:29:13,446 And here's my question. 565 00:29:13,626 --> 00:29:16,656 Let's just say I've got the best, the absolute best. 566 00:29:17,496 --> 00:29:20,166 Backup and disaster recovery system in the world. 567 00:29:20,166 --> 00:29:23,826 I've got a button that I can press and five seconds later, my entire 568 00:29:23,826 --> 00:29:26,736 environment is recovered without incident. 569 00:29:27,456 --> 00:29:31,086 How well will that help me with an extortion attack? 570 00:29:31,221 --> 00:29:31,611 Prasanna Malaiyandi: It wouldn't 571 00:29:32,256 --> 00:29:32,766 W. Curtis Preston: Not at 572 00:29:32,766 --> 00:29:32,886 all. 573 00:29:33,726 --> 00:29:34,416 That's the worst. 574 00:29:34,686 --> 00:29:35,526 That's the worst part. 575 00:29:35,531 --> 00:29:36,366 I this whole thing. 576 00:29:37,131 --> 00:29:38,901 Prasanna Malaiyandi: well, and this is my problem. 577 00:29:38,901 --> 00:29:42,441 I know we had talked about comparing classic ransomware to digital ransomware. 578 00:29:42,841 --> 00:29:43,261 W. Curtis Preston: Mm-Hmm. 579 00:29:43,791 --> 00:29:44,151 Prasanna Malaiyandi: Right. 580 00:29:44,571 --> 00:29:47,931 In classic ransomware, you pay the ransom. 581 00:29:48,231 --> 00:29:50,901 They may or may not return the person, but if they return the 582 00:29:50,901 --> 00:29:51,861 person, you know you're good 583 00:29:52,536 --> 00:29:52,956 W. Curtis Preston: Right. 584 00:29:53,721 --> 00:29:55,161 Prasanna Malaiyandi: in digital ransomware. 585 00:29:55,191 --> 00:29:58,191 Even if you pay the ransom to give you back the encryption keys, they 586 00:29:58,191 --> 00:29:59,511 still have that original data. 587 00:30:00,771 --> 00:30:04,551 They could decide in a year, Hey, I'm gonna release this and embarrass you. 588 00:30:04,551 --> 00:30:06,141 They could decide, Hey, I'm just gonna release 589 00:30:06,141 --> 00:30:06,861 this anyway. 590 00:30:07,491 --> 00:30:07,851 Right. 591 00:30:07,881 --> 00:30:08,361 And. 592 00:30:08,646 --> 00:30:11,106 If there's no honor among thieves, right, 593 00:30:11,376 --> 00:30:11,826 W. Curtis Preston: Right. 594 00:30:11,886 --> 00:30:12,216 Right. 595 00:30:12,216 --> 00:30:14,376 Prasanna Malaiyandi: how can you trust that they will do the right thing? 596 00:30:15,246 --> 00:30:18,366 W. Curtis Preston: Yeah, you, you can, you can't, which is really why the only 597 00:30:18,516 --> 00:30:22,866 defense to this type of ransomware is to not let it happen in the first place. 598 00:30:22,866 --> 00:30:28,596 Which is why I think that people should be focusing a lot more on the 599 00:30:28,596 --> 00:30:31,056 prevention of exfiltration, right? 600 00:30:31,056 --> 00:30:35,526 Exfiltration is just a very fancy word for sucking the data 601 00:30:35,526 --> 00:30:36,726 out of your company, right? 602 00:30:36,786 --> 00:30:40,866 Um, and there are ways, there are ways to do that, but they are not. 603 00:30:41,516 --> 00:30:45,356 Easy and they come with a lot of false positives, et cetera, et cetera. 604 00:30:45,386 --> 00:30:49,646 So not everybody is that, um, hot on it. 605 00:30:49,916 --> 00:30:52,286 And I just think it's something that we need to continue to work on. 606 00:30:53,771 --> 00:30:54,041 Prasanna Malaiyandi: Yeah. 607 00:30:54,131 --> 00:30:55,721 Or detection also, 608 00:30:56,081 --> 00:30:56,321 right? 609 00:30:56,546 --> 00:30:57,446 W. Curtis Preston: Yes, yes. 610 00:30:57,656 --> 00:30:58,016 Yeah. 611 00:30:58,021 --> 00:31:02,246 Well, yeah, detecting it, detecting that you've got the ransomware detecting 612 00:31:02,246 --> 00:31:04,226 that the exfiltration is happening. 613 00:31:05,061 --> 00:31:06,741 Stopping the exfiltration, right? 614 00:31:06,741 --> 00:31:10,251 Because a lot of the exfiltration is all sent to like the same place right there. 615 00:31:10,251 --> 00:31:14,961 There's certain websites and things that, um, it's like, why are we 616 00:31:14,966 --> 00:31:19,371 sending data to what is like mega sum? 617 00:31:19,376 --> 00:31:21,261 And there's some big file sharing site. 618 00:31:21,471 --> 00:31:24,531 Like you, you should block all access to all, like, file 619 00:31:24,531 --> 00:31:25,851 sharing sites like that, right? 620 00:31:26,541 --> 00:31:30,051 Um, and then if you, if you have a legitimate need for that. 621 00:31:30,321 --> 00:31:34,281 Then, um, you open it up, but chances are you probably don't. 622 00:31:35,256 --> 00:31:35,316 Prasanna Malaiyandi: Yeah. 623 00:31:35,811 --> 00:31:36,081 W. Curtis Preston: Yeah. 624 00:31:37,071 --> 00:31:41,811 Um, so that's just a brief overview of what ransomware is, what it isn't, 625 00:31:42,171 --> 00:31:46,161 how it's evolved, uh, in terms, and by the way, just a final thing regarding 626 00:31:46,161 --> 00:31:51,351 the whole exfiltration thing, talk, talking about part two and part three. 627 00:31:51,501 --> 00:31:55,851 Not only have they gone directly attacking the backup systems in order to. 628 00:31:56,976 --> 00:31:59,226 Basically take them out of the war. 629 00:32:00,006 --> 00:32:06,156 The, that's not what I, that's not what I meant to take them, to take to, to take 630 00:32:06,156 --> 00:32:09,096 them away from you as a weapon in the war. 631 00:32:10,266 --> 00:32:14,946 I, I don't know, I'm mixing metaphors here, but they're also, they've discovered 632 00:32:14,946 --> 00:32:17,526 that it is a source for exfiltration. 633 00:32:17,916 --> 00:32:21,576 So if they can gain, uh, unrestricted access to the backup 634 00:32:21,576 --> 00:32:24,336 system, then um, they can do that. 635 00:32:24,336 --> 00:32:26,226 And by the way, if, if you, if you're. 636 00:32:26,496 --> 00:32:27,786 This is your first episode. 637 00:32:27,786 --> 00:32:30,456 You really should go back a couple episodes and listen to that episode 638 00:32:30,456 --> 00:32:35,466 with Dwayne Lalo, uh, where, where it's talking about a red team P person, and 639 00:32:35,466 --> 00:32:39,966 he talked about just how great it is if you can gain access to a backup system. 640 00:32:39,971 --> 00:32:41,886 He, he was like, I love backup systems. 641 00:32:43,506 --> 00:32:43,776 Right. 642 00:32:44,046 --> 00:32:45,486 Yeah, that was a great episode. 643 00:32:45,726 --> 00:32:46,626 Any final thoughts? 644 00:32:47,586 --> 00:32:50,406 Prasanna Malaiyandi: No, I think, yeah, we covered sort of what's ransomware, 645 00:32:50,406 --> 00:32:54,486 what isn't, and yeah, like you said, Curtis, at the beginning I was also 646 00:32:54,486 --> 00:32:58,386 thinking, oh, it's just software installed that someone drops onto your system. 647 00:32:58,386 --> 00:33:03,126 But really it's this lengthy process that happens in order to 648 00:33:03,131 --> 00:33:04,806 be able to gain that foothold. 649 00:33:04,811 --> 00:33:05,406 And so, 650 00:33:06,151 --> 00:33:06,441 W. Curtis Preston: Yeah. 651 00:33:06,936 --> 00:33:09,126 And I, and I, I do think that maybe that's the way it's, 652 00:33:09,186 --> 00:33:10,596 that's the way it started, right? 653 00:33:10,601 --> 00:33:13,116 It was an initial piece of software that you just happened to download 654 00:33:13,116 --> 00:33:14,376 and it would encrypt your data, boom. 655 00:33:14,376 --> 00:33:18,546 And then, and then, and reach out to the person so that they could, uh, do that. 656 00:33:18,756 --> 00:33:21,756 But that's not going to work in a large organization, right? 657 00:33:21,786 --> 00:33:22,086 Prasanna Malaiyandi: Yeah. 658 00:33:22,836 --> 00:33:26,106 W. Curtis Preston: So they, so their attack evolved as well, right? 659 00:33:26,106 --> 00:33:29,796 So they've evolved over the time to go after a bigger, bigger, and bigger fish. 660 00:33:30,051 --> 00:33:30,321 Prasanna Malaiyandi: Yeah. 661 00:33:30,681 --> 00:33:35,151 Well, and I think also that a lot of the security infrastructure has 662 00:33:35,156 --> 00:33:38,691 also evolved, and so the ransomware attackers are also evolving. 663 00:33:38,931 --> 00:33:40,761 In turn, it's like a cat and mouse game. 664 00:33:41,661 --> 00:33:42,411 W. Curtis Preston: Exactly. 665 00:33:42,711 --> 00:33:46,641 Um, and, and you know, you have to be right all the time. 666 00:33:46,641 --> 00:33:49,406 They only have to be right once, unfortunately. 667 00:33:50,386 --> 00:33:50,721 All right. 668 00:33:50,721 --> 00:33:52,011 Well thanks for having a chat. 669 00:33:53,301 --> 00:33:53,481 Prasanna Malaiyandi: Yeah. 670 00:33:53,481 --> 00:33:54,081 It was good. 671 00:33:54,201 --> 00:33:54,831 I enjoy these. 672 00:33:54,836 --> 00:33:56,601 I'm excited for this new series. 673 00:33:56,601 --> 00:33:56,631 I. 674 00:33:56,841 --> 00:33:57,501 W. Curtis Preston: Yeah, me too. 675 00:33:58,736 --> 00:34:01,556 Thanks to our listeners, uh, we'd be nothing without you. 676 00:34:01,676 --> 00:34:04,136 Make sure to subscribe so that you don't miss an episode. 677 00:34:04,556 --> 00:34:05,696 That is a wrap, 678 00:34:09,246 --> 00:34:13,956 The backup wrap up is written, recorded and produced by me w Curtis Preston. 679 00:34:14,526 --> 00:34:15,996 If you need backup or Dr. 680 00:34:15,996 --> 00:34:19,626 Consulting content generation or expert witness work, 681 00:34:19,926 --> 00:34:21,876 check out backup central.com. 682 00:34:22,626 --> 00:34:25,746 You can also find links from my O'Reilly Books on the same website. 683 00:34:26,406 --> 00:34:30,486 Remember, this is an independent podcast and any opinions that you 684 00:34:30,486 --> 00:34:32,406 hear are those of the speaker. 685 00:34:32,471 --> 00:34:34,331 And not necessarily an employer. 686 00:34:35,231 --> 00:34:35,951 Thanks for listening.